#!/bin/bash
# Read-only fleet drift probe — gathers package/tooling/config state for
# consistency comparison across hosts. Writes only stdout.
set -u
echo "===== DRIFT PROBE: $(hostname -s)  $(date -u +%FT%TZ) ====="
echo
echo "##### OS / kernel / PVE #####"
pveversion 2>&1
cat /etc/debian_version 2>&1
echo
echo "##### Installed key packages (versions) #####"
dpkg-query -W -f='${Package}\t${Version}\n' 2>/dev/null | grep -iE 'lldpd|lldpad|smartmontools|nfs-common|nfs-kernel-server|iperf3|tcpdump|htop|rsyslog|qemu-guest-agent|snmpd|snmp|net-tools|ethtool|sysstat|ioping|fio|nvme-cli|conman|ser2net|nut-server|nut-client|tuned-adm|tuned' 2>/dev/null | sort
echo
echo "##### lldpcli present? #####"
command -v lldpcli >/dev/null 2>&1 && lldpcli -v 2>&1 | head -1 || echo "lldpcli: NOT INSTALLED"
echo
echo "##### lldpd service #####"
systemctl is-active lldpd 2>&1 || true
systemctl is-enabled lldpd 2>&1 || true
echo
echo "##### smartmontools service #####"
systemctl is-active smartd 2>&1 || echo "smartd: inactive/disabled"
systemctl is-enabled smartd 2>&1 || true
echo
echo "##### snmpd service #####"
systemctl is-active snmpd 2>&1 || echo "snmpd: not running"
systemctl is-enabled snmpd 2>&1 || true
echo
echo "##### rsyslog #####"
systemctl is-active rsyslog 2>&1 || echo "rsyslog: not running"
echo
echo "##### tuned profile #####"
tuned-adm active 2>&1 | head -2 || echo "tuned: not available"
echo
echo "##### sshd config (key settings) #####"
grep -E '^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|KbdInteractiveAuthentication|Port |PermitEmptyPasswords)' /etc/ssh/sshd_config 2>/dev/null || echo "(defaults)"
grep -E '^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|KbdInteractiveAuthentication|Port |PermitEmptyPasswords)' /etc/ssh/sshd_config.d/*.conf 2>/dev/null || true
echo
echo "##### authorized_keys (root) — count + key types #####"
if [ -f /root/.ssh/authorized_keys ]; then
  echo "  total keys: $(wc -l < /root/.ssh/authorized_keys)"
  awk '{print "  "$1}' /root/.ssh/authorized_keys | sort | uniq -c
else
  echo "  NO authorized_keys for root"
fi
echo
echo "##### ssh host key fingerprints #####"
for f in /etc/ssh/ssh_host_*_key.pub; do
  [ -f "$f" ] && ssh-keygen -lf "$f" 2>/dev/null
done
echo
echo "##### sysctl tuning (key values) #####"
echo "  net.core.rmem_max=$(cat /proc/sys/net/core/rmem_max 2>/dev/null)"
echo "  net.core.wmem_max=$(cat /proc/sys/net/core/wmem_max 2>/dev/null)"
echo "  net.ipv4.tcp_congestion_control=$(cat /proc/sys/net/ipv4/tcp_congestion_control 2>/dev/null)"
echo "  net.ipv4.tcp_rmem=$(cat /proc/sys/net/ipv4/tcp_rmem 2>/dev/null)"
echo "  net.ipv4.tcp_wmem=$(cat /proc/sys/net/ipv4/tcp_wmem 2>/dev/null)"
echo "  net.ipv4.tcp_max_syn_backlog=$(cat /proc/sys/net/ipv4/tcp_max_syn_backlog 2>/dev/null)"
echo "  net.core.netdev_max_backlog=$(cat /proc/sys/net/core/netdev_max_backlog 2>/dev/null)"
echo "  vm.swappiness=$(cat /proc/sys/vm/swappiness 2>/dev/null)"
echo
echo "##### CPU governor #####"
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || echo "no cpufreq driver"
echo
echo "##### beszel agent? #####"
systemctl is-active beszel-hub 2>/dev/null || systemctl is-active beszel-agent 2>/dev/null || echo "beszel: not installed"
echo
echo "##### /root/bin or custom scripts present? #####"
# shellcheck disable=SC2012  # diagnostic listing, not for processing
find /root/bin/ -maxdepth 1 -type f 2>/dev/null | head -10 || echo "(no /root/bin)"
find /root/ -maxdepth 1 -name '*.sh' -type f 2>/dev/null | head -10 || echo "(no /root/*.sh)"
echo
echo "##### mount options (noatime check on root) #####"
mount | grep ' / ' | head -1
echo
echo "##### NFS server threads (if NFS server) #####"
grep -E '^[[:space:]]*RPCNFSDCOUNT' /etc/default/nfs-kernel-server 2>/dev/null || grep -E 'RPCNFSDCOUNT' /etc/default/nfs-kernel-server 2>/dev/null || echo "(default, not a NFS server or default threads)"
echo
echo "===== END $(hostname -s) ====="